TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Zero Trust SIM

379 pointsby aofeishengover 2 years ago

35 comments

mikeceover 2 years ago
Great implementation of the wrong solution. The problem isn't that SIM security is weak but it's that we're using SIM/eSIM for identification and authorization in the first place. When we stop using SIM for authentication the need to guard against SIM Swap attacks goes away as well.
评论 #32989332 未加载
评论 #32984453 未加载
评论 #32983177 未加载
评论 #32989555 未加载
评论 #32983512 未加载
评论 #32991624 未加载
评论 #32983349 未加载
badrabbitover 2 years ago
Why is there no opposition to this shit? SIMs were physical for a reason. As a consumer what do you get out of it? You have to go through the carriers to switch between phones now! You can&#x27;t just pick up a random unlocked phone and put a sim in it. No more burner phones. I have been in situations where I changed SIM between phones multiple times a day.<p>But it sounds like it is too late for this. It&#x27;s like people who oppose cash payments out of the convenience of card&#x2F;app payments. This small chipping away of a small libery adds up.<p>I hope eveyone knows that you can&#x27;t as a layman register an email address or any meaningful service you depend on without a phone number (i.e.: a sim), that is what is being regulated here even more.
评论 #32984290 未加载
评论 #32983470 未加载
评论 #32984959 未加载
评论 #32983868 未加载
评论 #32986549 未加载
评论 #32985528 未加载
评论 #32983505 未加载
评论 #32991813 未加载
评论 #32984919 未加载
评论 #32986458 未加载
评论 #32985903 未加载
评论 #32988305 未加载
评论 #32984196 未加载
评论 #32987310 未加载
评论 #32990282 未加载
评论 #32985890 未加载
评论 #32988989 未加载
评论 #32988512 未加载
评论 #32984221 未加载
评论 #32989804 未加载
评论 #32989207 未加载
评论 #32983615 未加载
评论 #32983806 未加载
评论 #32983476 未加载
zzz95over 2 years ago
How is this even Zero Trust. Admittedly, there is no precise definition for ZT, but Cloudflare&#x27;s solution seems to run counter to the idea of perimeter-less ZT philosophy. Instead of assuming that phones can be insecure and developing appropriate crypto based mechanisms, Cloudflare is proposing to bring the phone inside a &#x27;trusted&#x27; network. Remember, ZT does not rely on trusted network.<p>Solutions like this will increase confusion and fragment the already &#x27;interpretation led&#x27; as opposed to definition led ZT landscape.
评论 #32989519 未加载
评论 #32991268 未加载
评论 #32991240 未加载
yellow_leadover 2 years ago
&gt; What if employers could offer their employees a deal: we&#x27;ll cover your monthly data costs if you agree to let us direct your work-related traffic through a network that has Zero Trust protections built right in?<p>No thanks..What is &quot;work-related&quot; and what isn&#x27;t? I see huge privacy implications here. If my company wants to install this potential-spyware on my phone then they should just offer a separate phone. Personally, I don&#x27;t mind carrying it if I&#x27;m &quot;on-call&quot; one week out of the month or whatever.
评论 #32986383 未加载
wildeover 2 years ago
&gt; And all this is before you add in the further complication of Bring Your Own Device (BYOD) that more employees are using — you’re trying to deploy Zero Trust on a device that doesn’t belong to the company.<p>Yeah, this is a pretty impressive technical solution to a problem created by the company. “We’re too cheap to buy equipment for our employees to use, so instead we need to spy on all of your personal data.”
评论 #32991297 未加载
softfalconover 2 years ago
I&#x27;m seeing a lot of people advocating for either eSIM or standard SIM slot. I feel like the real question should be &quot;why not both?&quot;<p>I know there are economics, control, tracking, or whatever at play. Regardless, I think the phone should have a SIM slot and it should ALSO have eSIM functionality.<p>I can almost guarantee the reason they&#x27;re pushing for eSIM is because it&#x27;s cheaper to manufacture a phone without a milled out slot with water sealant lining, little switch to pop out the SIM deck, etc.<p>Can we all not agree that the real &quot;enemy&quot; here is the corporations taking away your options? If we were really thinking about the consumer here, we&#x27;d be ensuring you had access to both technologies to ensure your phone is robust and capable of working on any network regardless of their SIM requirements.<p>Maybe this is crazy talk though. Maybe eSIM is so amazing, old SIM doesn&#x27;t even matter anymore, but I can&#x27;t help but feel like I&#x27;m right here, because having both quite literally appeases everyone except rich corpo&#x27;s trying to save a buck.
评论 #32989839 未加载
评论 #32990503 未加载
greenie_beansover 2 years ago
I can&#x27;t help but think of Room 641A every time they announce a new project where they&#x27;re like &quot;we&#x27;ll take care of it by directing your traffic through our network&quot;<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Room_641A" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Room_641A</a><p>edit: whoops. let me be clear that i&#x27;m a big fan of cloudflare! that&#x27;s just where my brain wanders sometimes
评论 #32985589 未加载
评论 #32983647 未加载
评论 #32983875 未加载
jupp0rover 2 years ago
&quot;We have sophisticated logging set up as part of Cloudflare One, and this will extend to Cloudflare SIM. Today, Cloudflare One can be explicitly configured to log only the resources it blocks — the threats it’s protecting employees from — without logging every domain visited beyond that.&quot;<p>So my employer can log all of my network traffic metadata, but I can take their word for it that they have some setting set that it only logs hits on their deny list that they are filtering my private internet usage with? CloudFlare needs to give more power to employees here to make sure that employers are completely unable to monitor any traffic that doesn&#x27;t go to their networks. The abuse potential for this in its current form is gigantic.
评论 #32985887 未加载
评论 #32989848 未加载
lxgrover 2 years ago
What&#x27;s the advantage of using this vs. installing a mandatory VPN via an MDM profile? For mobile data, the outcome seems to be identical, but it would also work for Wi-Fi.
评论 #32985628 未加载
评论 #32986627 未加载
评论 #32985750 未加载
dathinabover 2 years ago
&gt; [..] logs only what it blogs<p>putting aside that it&#x27;s not clear weather it can be configured to do so or always does so and if the employee has any way to know if it is configured to log only blocked content or log everything its still a no-go<p>the things is that content which is fully legal no-risk is feed all the time into block list and fishing protection to make it less accessible<p>for example the CCC ticket selling side was frequently &quot;somehow&quot; in the minor protection DNS filter enabled by default by all UK ISPs...<p>you can be pretty sure that union and employer right protection related sites will &quot;somehow&quot; end up in the filter and not only will that bar the employee from realizing their information need&#x2F;rights, it will also show up in the log accessible to the employer<p>then you probably can configure the &quot;protection&quot;. How long will it take to be possible to enable blocking of adult-content or similar? This would lead to a potential indirectly exposing of employee sex related preferences to the employer, or religion, or ...<p>Trying to pretend this system is not incredible invasive to employees privacy is hypocrisy and puts a pretty bad light on cloudflair. I mean they could say it&#x27;s less invasive then many other existing methods, I guess that might be right, but that doesn&#x27;t mean it&#x27;s okay at all.<p>In the end trying to marry BYOD with security is just nonsense. If the work tasks need a phone then provide a phone to the employee (which could use this system). If you only worry about 2FA use HSKs. Remove phones out of any security related procedure, that is anyway recommended for other reasons like SIM-hijacking. Then don&#x27;t require or allow employees to install anything which could be used as a attack vector on their private phone, no slack, no teams no nothing. If there is an emergency you can call them and tell them to use their employer provided device, it&#x27;s that simple.
totetsuover 2 years ago
&gt; Mitigating common SIM attacks: an eSIM-first approach allows us to prevent SIM-swapping or cloning attacks, and by locking SIMs to individual employee devices, bring the same protections to physical SIMs.<p>I thought a sim swap attack is carried out by asking the operator to reissue a sim card, and getting it done via a failure of identity verification or a collaborator working at the operator. What is to stop just requesting the re-issue of an eSIM to a new device in the same way?
评论 #32994090 未加载
lizardactivistover 2 years ago
You can say that again. Zero trust that Cloudflare, the largest man-in-the-middle of the Internet which began its life as a CIA honeypot, will not abuse this.
评论 #32985728 未加载
评论 #32984714 未加载
评论 #32984837 未加载
nanankcorneringover 2 years ago
Please make this product available for non-enterprises too (at a cost, of course.) @jgrahamc @eastdakota
评论 #32982750 未加载
mschuster91over 2 years ago
The only attack this is preventing is corrupt or confused mobile network customer service representatives issuing a valid SIM card to an attacker so that the attacker can intercept 2FA SMS messages, but any larger-ish company should already have a corporate phone plan with <i>clearly</i> established contact points to do any kind of change.<p>So what I don&#x27;t really get is, what is the actual advantage? And besides, Cloudflare <i>will</i> have to run as an MVNO if they&#x27;re rolling their own SIM cards &#x2F; eSIM keys, which almost always means lower quality of service in congested network areas - there is no requirement for equal treatment of MVNOs I&#x27;m aware of, and even here in the EU you can clearly see that providers discriminate even between premium post-paid contracts and pre-paid contracts. Switching from Telekom&#x27;s <i>own</i> MVNO Congstar to Telekom proper was night and day.
评论 #32983326 未加载
评论 #32983877 未加载
gigel82over 2 years ago
Oh, that&#x27;s disappointing, I was hoping they&#x27;re entering the MVNO space with a consumer offer. Instead, it&#x27;s an offer for companies to further spy on their employees :(
vlover 2 years ago
I’m confused about what it is.<p>It looks like it’s Cloudfare’s MVNO eSIM. What’s zero trust about it?
评论 #32986076 未加载
raszover 2 years ago
That is a lot of text to say &quot;trust us bro&quot;. First we gave cf decryption keys to most of https web traffic, now they want to own cellphones, for our privacy of course!
bhcover 2 years ago
&gt;But in recent years, nearly every modern phone shipped today has an eSIM<p>How many phones other than iPhone, Pixel, and (very recent) Galaxy S&#x2F;Z have eSIM? There aren&#x27;t that many cellular IoT boards that support swappable eSIM either (some boards say eSIM, but what they mean is that the IoT vendor&#x27;s SIM is soldered onto the board - thus &quot;embedded SIM&quot;- not that you&#x27;re allowed to load eSIM of your choice).
eastonover 2 years ago
Is the idea with this that it&#x27;ll be a data-only eSIM? I&#x27;m not seeing any mentions of phone service in the blog post (maybe it&#x27;s just implied and I&#x27;m dumb). I think iOS and Android have support for multiple eSIMs where one is used for data service, so that would work, although I don&#x27;t know if companies want to pay for everyone to have a data plan AND a SMS+phone plan.
评论 #32983435 未加载
ignoramousover 2 years ago
So, a matter of time before Cloudflare acquires <a href="https:&#x2F;&#x2F;gigs.com" rel="nofollow">https:&#x2F;&#x2F;gigs.com</a>?
评论 #32983966 未加载
jacooperover 2 years ago
So its basically a Sim with a VPN Built in?
评论 #32983153 未加载
评论 #32985659 未加载
评论 #32983018 未加载
radicaldreamerover 2 years ago
Every one of these product launches makes me think Cloudflare is the CryptoAG of our time. There&#x27;s an immense amount of centralization happening under this company under the guise of &quot;security&quot;.
formerly_provenover 2 years ago
I honestly don&#x27;t particularly get BYOD. The savings on the company side seem so marginal for a lot more uncertainty, more support issues and worse employee mental health etc.
评论 #32983332 未加载
评论 #32983867 未加载
评论 #32983744 未加载
silentlinkuserover 2 years ago
<a href="https:&#x2F;&#x2F;silent.link&#x2F;" rel="nofollow">https:&#x2F;&#x2F;silent.link&#x2F;</a> is the real 0 trust SIM:<p>&quot;Anonymous eSIM<p>Get global mobile 4G&#x2F;5G Internet access and burner phone numbers instantly and privately on any modern eSIM-compatible smartphone.<p><pre><code> Pay as you go international roaming in 200+ countries Worldwide coverage at low prices </code></pre> pay with bitcoin or lightning&quot;<p>I&#x27;m just a user. I use it at times. It works well and prices are ok.
neilvover 2 years ago
&gt; <i>By integrating Cloudflare&#x27;s security capabilities at the SIM-level, teams can better secure their fleets of mobile devices, especially in a world where BYOD is the norm and no longer the exception.</i><p>Please consider <i>not</i> doing BYOD for company business.<p>Quick summary of IMHO, from some companies where I&#x27;ve defined or advised on infosec policy...<p>From the employer side, BYOD is bad for security and liability. From the employee side, BYOD is bad for privacy&amp;security.<p>Regarding employee&#x27;s personal info on BYOD (since it&#x27;s less familiar concern than company protecting IP and operations)... Whether or not there&#x27;s MDM, it&#x27;s a big problem for employee and company, when security team needs to investigate an incident, or when legal proceedings mandate that forensics expert clone&#x2F;search a device, and that bumps into personal info. (Personal info revealed can include private personal conversations, intimate photos&#x2F;videos of employee and partners, job searching, medical information, non-public sex&#x2F;gender&#x2F;etc. identity, protected classes for discrimination, Web history, etc., to possibly the company or some outsiders.) Also a big problem if the company needs to wipe or lock a device to secure IP, and that would wipe personal data or lock employee out of it.<p>No work on personal devices. No personal on work devices. Being strict about this from the start is to everyone&#x27;s benefit (before complicating practices set in, the wrong services are bought&#x2F;deployed, etc.).<p>For employees who actually need to carry smartphones for business (e.g., executives, marketing, sales, other non-engineers), the company should issue devices with plans, to be used exclusively for business.<p>For work calls for people who don&#x27;t get issued company smartphones, use a service from the work laptop.<p>For rare alerting eng&#x2F;ops&#x2F;etc. in the off-hours, when they don&#x27;t have a company-issued smartphone, alerting can be to a personal device, but the alert should convey no info other than what is the urgency to get to the company laptop.<p>Also possible side life balance benefit of strict work and personal separation on devices, especially with WFH&#x2F;hybrid and carrying a laptop home: without work on personal devices, an employee can just physically put the work device(s) in a drawer&#x2F;bag for the evening, and call work over for the day, or until they&#x27;re ready to take it out. (No associating their personal devices with work, no interrupting with work off-hours while people recharging and with family, no trying to use unreliable software settings correctly to suppress work messages at some times and not others, etc.)
c8gover 2 years ago
Unfortunately, I guess, it won&#x27;t available in the most part of the of the world at a competitive price to local operator.
base0010over 2 years ago
I had hopes this product would be way less draconian. People miss the real reason you should push back on eSIM-only devices! It seems that most of HN hasn&#x27;t done their DD on how eSIM provisioning dosen&#x27;t work unless you&#x27;re a billion dollar telco incumbant..... The eSIM-only precedent telco tech giants are pushing towards is part of the time honored tradition of locking consumers out of their own hardware. Indeed, this is another version of &quot;the carrier owns the hardware you&#x27;ve purchased&quot;.<p>TL;DR in order to provision an eSIM to live inside the eUICC (secure element inside phone); as per GSMA standards your eSIM HAS to have a key signed by a SOLE CA determined by the GSMA and the incumbent billion dollar telco industry cartel!!! With a SIM-card you have the freedom to connect to any network you want including those that aren&#x27;t inside the realm of:<p>&quot;Only eUICC manufacturers, and SM-SR and SM-DP hosting organisations that have successfully been accredited by the GSMA SAS can apply for the necessary certificates from the GSMA Certificate Issuer to participate in the GSMA approved ecosystem.&quot;<p>Please push back on this draconian nonsense as a whole people!!!<p>eSIM Whitepaper: <a href="https:&#x2F;&#x2F;www.gsma.com&#x2F;esim&#x2F;wp-content&#x2F;uploads&#x2F;2018&#x2F;06&#x2F;eSIM-Whitepaper-v4.11.pdf" rel="nofollow">https:&#x2F;&#x2F;www.gsma.com&#x2F;esim&#x2F;wp-content&#x2F;uploads&#x2F;2018&#x2F;06&#x2F;eSIM-Wh...</a>
评论 #32989685 未加载
ranger_dangerover 2 years ago
How are they the first? MobileIron and others have been offering solutions for at least 2.5 years now.
ck2over 2 years ago
random fun cloudflare related thing I learned last week, their &quot;private dns&quot; address is &quot;one.one.one.one&quot; which is even easier to remember than &quot;dns.google&quot; (there is also &quot;dns.adguard.com&quot; and &quot;dns.quad9.net&quot;)
评论 #32984774 未加载
2Gkashmiriover 2 years ago
wait till clouflare decides to ban a website from their network and you suddenly cannot access them unless YOU CHANGE YOUR SIM PROVIDER, that sounds fun
评论 #32993059 未加载
评论 #32984759 未加载
puyoxyzover 2 years ago
I am NOT using a sim from Cloudflare
barathrover 2 years ago
I think the term &quot;zero trust&quot; creates a bit of confusion, in this and other contexts -- not Cloudflare&#x27;s fault, because the term has been used&#x2F;abused quite a bit. I think it&#x27;s a good idea to prevent SIM swapping attacks, and it looks like this will, like Efani does.<p>TLDR: this will lock a corporate SIM to a device and then connect the device to the perimeterless corporate network.
评论 #32983944 未加载
BrainVirusover 2 years ago
They want to be in front of every website, behind every DNS request and now they want to control your cellphone traffic - while bleeding money by tens of millions of dollars a year and making promises they don&#x27;t intent to keep. The trajectory of this company&#x27;s life is obvious in advance.
drummerover 2 years ago
Seeing as how Cloudflare can cancel and censor you at will and has done to others recently, you&#x27;d have to be crazy to trust them with your phone and sim.
tekchipover 2 years ago
Wow, eSIMs hit first in this discussion? Not the glaring nightmare of security QR codes are. I thought about providing links but there&#x27;s such a vast host of writeups about it I&#x27;ll leave it for the reader to search and discover. Yikes.